From 043b9027b3cc1c055e4ec5917f5d0d9bdc69005f Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Tue, 29 Oct 2013 14:42:41 -0400
Subject: [PATCH] Confine watchdogd, but leave it permissive for now.

Change-Id: If2285e927cb886956b3314dd18384145a1ebeaa9
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
 watchdogd.te | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/watchdogd.te b/watchdogd.te
index 9af871cdd..33609e47f 100644
--- a/watchdogd.te
+++ b/watchdogd.te
@@ -1,4 +1,11 @@
 # watchdogd seclabel is specified in init.<board>.rc
 type watchdogd, domain;
-unconfined_domain(watchdogd)
-allow watchdogd rootfs:file entrypoint;
+permissive watchdogd;
+allow watchdogd rootfs:file { entrypoint r_file_perms };
+allow watchdogd self:capability mknod;
+allow watchdogd device:dir { add_name write remove_name };
+allow watchdogd watchdog_device:chr_file rw_file_perms;
+# because of /dev/__kmsg__ and /dev/__null__
+write_klog(watchdogd)
+type_transition watchdogd device:chr_file null_device "__null__";
+allow watchdogd null_device:chr_file { create unlink };
-- 
GitLab